Latest revision as of 05:32, 28 February 2009

Description

Java byte code has no notion of an inner class; therefore inner classes provide only a package-level security mechanism. Furthermore, the inner class gets access to the fields of its outer class even if that class is declared private.

Consequences

Confidentiality: "Inner Classes" data confidentiality aspects can often be overcome.

Exposure period

Implementation: This is a simple logical flaw created at implementation time.

Platform

Languages: Java

Operating platforms: Any

Required resources

Any

Severity

Medium

Likelihood of exploit

Medium

A common misconception by Java programmers is that inner classes can only be accessed by outer classes. Inner classes' main function is to reduce the size and complexity of code. This can be trivially broken by injecting byte code into the package. Furthermore, since an inner class has access to all fields in the outer class - even if the outer class is private - potentially access to the outer classes fields could be accidently compromised.

Implementation: Inner Classes do not provide security. Warning: Never reduce the security of the object from an outer class, going to an inner class. If your outer class is final or private, ensure that your inner class is private as well.